What's happening in security
Breaches, credential dumps, actively exploited bugs and AI incidents — pulled from 5,636 items across public feeds, Have I Been Pwned and CISA KEV.
Biggest this week
- Westcon-Comstor posts record US$3.37B first-half sales as APAC demand for AI, cloud and cyber accelerates — Reseller News (NZ), 2d ago
- GitHub Octoverse 2026 — Simon Willison (AI), 4d ago
- Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen — The Hacker News, 2d ago
- Upwind Security Raises $400 Million at $3.8 Billion Valuation — SecurityWeek, 4d ago
- Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds — The Record, 2d ago
-
Shame and sleepless nights haunt scam victims long after the money is gone
Scams and identity theft hurt people in different ways, and recovering involves much more than getting money back, according to ITRC’s 2026 Consumer Impact Report. Scam victims often struggle with shame and self-blame, while ident…
-
Stolen staff logins are spreading attacks between K-12 school districts
Last school year, 808 K-12 school organizations got some unwelcome news. The Multi-State Information Sharing and Analysis Center (MS-ISAC) told them their staff accounts or credentials were circulating on underground and dark web …
-
Bluesky Is Blocking Links to a Major Leak of DHS Employee Records
Bluesky tells WIRED it blocked links to a leaked archive of information on 41,000 ICE, CBP, and other DHS workers because it contains people’s contact information, shared without their authorization.
-
Officials seize domain of top bulletproof hosting provider Virtualine
The Russian-speaking cybercrime storefront was among the most active bulletproof hosting providers this year to date, receiving almost one-fifth of all illicit-attributed inflow tracked by researchers. The post Officials seize dom…
-
Smashing Security podcast #490: How Jared Kushner’s iPhone was allegedly hacked twice
Dutch spies, Russian hackers and Jared Kushner’s iPhone. It sounds like the ingredients for a thriller, but according to claims in a new book the US President's son-in-law may have been hacked twice. Is any of it true, and what do…
-
CVE-2026-97229: GitLab Community Edition and Enterprise Edition — GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular express…
-
CVE-2026-76418: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software — Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexp…
-
Quoting Ted Sanders
In general, LLM performance is incredibly multidimensional. There's no guarantee of a fixed ordering where the model that is best at math is also the model that's best at jokes. Despite that complexity, much of the variation in pe…
-
Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists
The Department of Peace group shared it with Swiss hacker/journalist maia arson crimew and DDoSecrets put it online. The post Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists appeared first on Cyb…
-
Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
Talos has identified UAT-11473, a highly sophisticated APT, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain unauthorized access t…
-
Court strikes down West Virginia law barring disclosure of public officials’ personal data
A federal appellate court panel said West Virginia's version of Daniel's Law — meant to shield the personal data of police and other officials — is unconstitutional.
-
Police seize Virtualine bulletproof service tied to ransowmare, cybercrime
U.S. law enforcement has seized the primary domain of Virtualine, a bulletproof hosting service advertised on cybercrime forums for facilitating illegal activities. [...]
-
Japan Airlines warns of data breach as country grapples with multiple cyber incidents
Hackers stole passport numbers, frequent flyer numbers, email addresses and phone numbers for about 2,000 customers.
-
Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution Flaw
The critical flaw in UEFI firmware—used by most server vendors and data centers—allows attackers to execute code early in the boot process.
-
Victory! You Can Now Exclude Apps from Siri AI
In the most recent update to Apple’s devices, iOS 27.2, the company has introduced a new setting to “Exclude Apps” from Siri AI, fulfilling one of our asks from our Encrypt It Already campaign earlier this year . One of our main c…
-
Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents
The leaked records include the locations of ICE and CBP facilities, workers' cellphone numbers, and the members of groups tied to wiretap programs, Palantir software, and xAI’s Grok chatbot.
-
Court Should Curb Abuse of Grand Jury Subpoenas Targeting Social Media Users
A federal appeals court should curb the government’s abuse of grand jury subpoenas to unmask social media users who criticize lawless immigration enforcement. That is the message from the ACLU, EFF, and other civil liberties and t…
-
GhostAction Hacking Wave Fizzles, But Attackers Lurk on in GitHub
The supply chain attack campaign's shift toward developer endpoints and cloud access signals what could be next for the cybercrime outfit.
-
When the Fire Comes, Our Phones Have to Work. Condition 50 Puts That at Risk.
In the hills of West Sonoma County, a fire can crest a ridge faster than an evacuation order can reach you. In our Hacienda Firewise Council, we practice phone trees, walk our escape routes and keep go-bags by the door. Every one …
-
Lawsuit against Ex-Overstock CEO tied to 2020 election film falls apart over question of ‘actual malice’
The lawsuit, brought by a former executive at Dominion Voting Systems, concerns comments made in a 2020 film financed by Byrne titled “The Deep Rig.” The post Lawsuit against Ex-Overstock CEO tied to 2020 election film falls apart…
-
Discord to let search engines index public server messages
Discord will allow search engines to index discussions in Discoverable Servers and make them accessible on the web to users outside the platform without an account or invitation. [...]
-
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access. "First identifie…
-
European digital rights nonprofit noyb sues Scale AI for ‘invasive’ worker surveillance
Noyb alleges the platform in some cases records freelancers’ mouse clicks and keystrokes every few seconds and claims the collected information can be used to generate video documenting freelancers’ entire workday.
-
Unwrapping Retail Peak Season Cyber Threats
Unit 42 explores key peak shopping season retail cyber threats, from ransomware to AI attacks, and shares how to defend operations and customer trust. The post Unwrapping Retail Peak Season Cyber Threats appeared first on Unit 42 …
-
US sanctions Russians, North Koreans for laundering IT worker earnings
The U.S. Treasury Department sanctioned Russian and North Korean nationals for allegedly laundering the earnings of illicit IT workers on behalf of Pyongyang.
-
GitHub’s npm package firewall can block brand-new versions before they install
GitHub announced a package firewall that checks npm packages against an enterprise’s policy before they install. It blocks known malware, critical vulnerabilities, and brand-new versions, and any developer can turn it on by pointi…
-
Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S.
Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks …
-
Sony ISP subsidiary data breach exposes 2.5 million customer records
Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers' personal information. [...]
-
GitHub Octoverse 2026
GitHub Octoverse 2026 I'm at GitHub Universe today (GitHub gave me a free ticket through their "GitHub Stars" program). EVP Jay Parikh just announced this year's Octoverse report, and highlighted these numbers in particular: This …
-
Moldova investigates possible foreign involvement in major government cyberattack
Prime Minister Vasile Tofan said the incident may be part of a broader campaign targeting both citizens' personal data and government digital infrastructure, according to local media reports.
-
Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win
A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. Orange Tsai of DEVCORE published the full …
-
PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network
Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach…
-
Managed for Malice: How Attackers Turn MDM into Remote Access
Attackers abuse legitimate MDM platforms to deploy rogue RMM tools, turning device management into a pathway for remote access and persistence.
-
Researchers uncover Volt Typhoon’s covert, ephemeral network
The China-linked threat group has used the “Silent Train” framework, built on a series of rapidly rotating compromised devices, to infiltrate hundreds of critical infrastructure networks. The post Researchers uncover Volt Typhoon’…
-
Volt Typhoon hides zero-day attacks using 'Silent Train' framework
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. [...]
-
The CISO’s evolving role: Protecting and defending in the agentic era
As AI and agents reshape the enterprise, CISOs face two critical priorities: enabling innovation with the right identity and data guardrails, and modernizing defense to keep pace with AI-powered threats. Aarti Borkar shares how se…
-
So I came across this on LinkedIn yesterday. It made me angry and I've been trying to work out why that is and…
So I came across this on LinkedIn yesterday. It made me angry and I've been trying to work out why that is and if my anger is justified, so bear with me as I dump my thoughts here. Would love some feedback/conversation on this. I …
-
UK to look at making software companies liable for cyber breaches
The new U.K. budget says the government will "consider where liability for cyber breaches should sit," potentially a landmark shift for a country that has relied on voluntary codes to encourage software vendors to improve security…
-
Prosecutors charge Madagascar scammers in NFT-stealing scheme based on fake online dating profiles
The scammers affected approximately 800 victims and led to losses of more than half a million dollars, the Justice Department said. The post Prosecutors charge Madagascar scammers in NFT-stealing scheme based on fake online dating…
-
Insurance industry fears potential impacts stemming from PHP2Shell
A systemic cyber event could lead to billions of dollars in claims that exceed current risk models.
-
AI Takes Root in Hospital Corridors, Raises Security Stakes
Artificial intelligence (AI) is everywhere in healthcare, from doctors’ intake forms to cancer screenings. But, in some cases, life-and-death uses are outpacing cyber security.
-
Hive ransomware affiliate jailed, years after FBI infiltrated the gang’s systems
A Ukrainian man who carried out ransomware attacks for both the Nefilim and Hive gangs, including attacks on law firms and a healthcare provider during the COVID-19 pandemic, has been sentenced to 70 months in a US prison. Read mo…
-
I underestimated how fast security teams would trust AI to act in the SOC
For most of my career, I have watched new security platforms work through enterprise programs at a slow pace, so when AI began showing up in security operations tools, I assumed it would follow the same path. I expected AI adoptio…
-
💾 Fighting DOGE's Data Grab | EFFector 38.19
When we give our private information to the government to pay taxes, apply for a job, or vote, we should be able to trust that our data won't later be used against us. But in a betrayal of that trust, the federal government has be…
-
Belarusian hackers increasingly acting as proxies for Russia amid war in Ukraine
Belarus-linked hackers are increasingly aligning their cyber operations with Russia's interests in Ukraine, researchers said Wednesday.
-
Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
Artem Stryzhak was sentenced to 70 months in prison after pleading guilty to using Nefilim ransomware in attacks. The post Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison appeared first on SecurityWeek …
-
Microsoft urges Entra ID admins to migrate users to passkeys
Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027. [...]
-
ControlUp’s Pulse AI Resolve diagnoses and fixes IT issues within admin-defined controls
ControlUp has announced Pulse AI Resolve, the real-time investigative AI layer of the Pulse AI ecosystem. A major enhancement of ControlUp’s endpoint self-service capability, previously ControlUp Connect, Pulse Resolve brings AI-p…
-
Hackers seize on vulnerable IoT devices to spy, pivot and route traffic
Known vulnerabilities with available patches are by far the biggest risk facing connected devices, a new report found.
-
Compromised camera management software gives attackers a way into corporate networks
Attackers have been breaking into business networks through camera management software, according to new research from security firm Huntress, which traced several incidents in September and October back to a compromised applicati…
Last fetch 2m ago · 1 new · 1 source error(s)